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T^FAT. PARTTFS T?NJ TiVTFI^FCIT 

Tlie real party in interest in this appeal is the following party: International Business 
Machines Corporation. 
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With respect to other appeals or interferences that will directly affect, or be directly aflfected 
by, or have a bearing on the Board^s decision in the pending appeal, there are no such appeals or 
interferences. 
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STATf TS OF n ATMS 

A. TOTAL NUMBER OF CLAIMS IN APPLICATION 

Claims in the application are: I, 3-16, 18-29, and 31-41 

B- STATUS OF ALL THE CLAIMS IN APPLICATION 

1 . Claims canceled: 2, 1 7, and 30 

2. Claims withdrawn from, consideration but not canceled: NONE 

3. ClatTns pending; 1, 3-16, 1 8-29, and 31-41 

4. Claims allowed: NONE 

5. Claims rejected: 1, 3-16, 18-29, and 31-41 

6. Claims objected to: NONE. 

C. CLAIMS ON APPEAL 

The claims on appeal are: 1 , 3-1 6, 18-29, and 31-41. 
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STATUS OF AMFTSmMlTNTS 

There are no amendments after final rejection. 
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SUMMARY OF ri.ATMF.D STTRTFrT MATTFT^ 

A. CLAIMS 1, 14, and 29 - INDEPENDENT 

The present invention provides a method in a data processing system for maintaining data 
integrity in logs (Specification, page 12, lines 1-4), the method comprising: reviewing a log, 
wherein the log includes a set of time segments, and wherein the set of time segments include at 
least one time segment defined by a user (Specification, page 12, liiie 17, to page 13, line 2, 
Figure 3, log analyzer 300, log 302); determining whether the log contains a data loss, wherein 
the determining step includes analyzing each time segment within the set of time segments to 
determine whether a time segment gap tolerance has been exceeded (Specification, page 16, lines 
1 2-17, Figure 5, step 502); and adding data to replace the data loss in the log to increase integrity 
of the log if a determination is made that a data loss has occunced (Specification, page 16, lines 
20-21, Figure 5, step 508). These features are recited in independent claims 1, 14, and 29 of the 
present invention. 

B. CLAIMS 8, 15, and 36 - INDEPENDENT 

The present invention also provides a method in a data processing system for analyzing a 
log (Specification, page 12, lines 1-4), the method comprising: analyzing a set of time segments 
in the log to determine whether a time gap tolerance has been exceeded for a time segment within 
the set of time segments, wherein the set of time segments include at least one time segment 
defined by a user (Specification, page 12, line 17, to page 13, line 2, Figure 3, log analyzer 300, 
log 302); and responsive to a determination that the time gap tolerance has been exceeded for the 
time segment within the set of time segments, generating an alert (Specification, page 16, lines 
17-1 8, Figure 5, step 504). These features are recited in independent claims 8, 15, and 36 of the 
present invention. 

C CLAIM 16 - INDEPENDENT 

Furthennore, the present invention provides a data processing system for maintaining data 
integrity in logs (Specification, page 12, lines 1-4), the data processing system comprising: 
reviewing means for reviewing a log, wherein the log includes a set of time segments, and 
wherein the set of time segments include at least one time segment defined by a user 
(Specification, page 12, line 17, to page 13, Une 2, Figure 3, log analyzer 300); determimng 
means for determining whether the log contains a data loss by analyzing each time segment 
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Within the set of time segments to determine whether a time segment gap tolerance has been 
exceeded (Specification, page 16, hnes 1 0-17, Figure 3, log analyzer 300); and adding means for 
adding data to replace the data loss in the log to increase integrity of the log if a determination is 
made that a data loss has occurred (Specification, page 1 6, lines 10-21, Figure 3, log analyzer 
300). These features are recited in independent claim 16 of the present in vention. 
D. CLAIM 21 - DEPENDENT 

Moreover, the present invention provides a data processing system (Specification, page 
1 2, lines l-4),wherein the analyzing means includes considering data in at least one time segment 
adjacent to a time segment being analyzed (Specification, page 17, line 12, to page 18, line 10, 
Figure 3, log analyzer. Figure 6, step 600). These features are recited in claim 21 of the present 
invention. 

£• CLAIM 23 - INDEPENDENT 

Additionally, tlic present invention provides a data processing system for analyzing a Jog 
(Specification, page 12, lines 1-4), the data processing system comprising: analyzing means for 
analyzing a set of time segments in the log to determine whether a time gap tolerance has beeri 
exceeded for a time segment within the set of time segments, wherein the set of time segments 
include at least one time segment defined by a user (Specification, page 20, line 25, to page 21, 
line 5, Figure 3, log analyzer 300, Figure 7, step 704); and generating means, responsive to a 
determination that the time gap tolerance has been exceeded for the time segment within the set 
of time segments, for generating an alert (Specification, page 16, lines 10-18, Figure 3, log 
analyser 300, Figure 5, step 504). These features are recited in independent claim 23 of the 
present invention. 

F. CLAIM 24 - DEPENDENT 

In addition, the present invention provides a data processing system (Specification, page 
12, lines 1-4) further comprising: adding means, responsive to detecting the alert, for adding data 
to the time segment within the set of time segments to increase the data integrity of the log 
(Specification, page 16, lines 10-21, Figure 3, log analyzer 300). These features arc recited in 
claim 24 of the present invention, 

G. CLAIM 27 " DEPENDENT 

What is more, the present invention provides a data processing system (Specification, 
page 12, lines 1-4) further comprising: calculating means for calculating a data integrity level for 
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the log (Specification, page 20, line 25, to page 21, line 17, Figure 3, log analyzer 300, Figure 7, 
step 712). These features are recited in claim 27 of the present invention. 
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nRmnvns of i>F.niTTTm>j to rf mrvTfWFn mv appit at . 

The grounds of rejection to be reviewed on appeal are: 

T. Claims 8, 11, 13, 23, 26, 28, 36, 39, and 41 are rejected as being allegedly 
uupatentable over Wu (U.S. Patent No. 5,931,912) in view of Boyd (U.S. Patent No. 6,112,238) 
under 35 U.S.C.§103(a). 

n. Claims 1, 3, 5-9, 11-16, 18, 20-24, 26-29, 31, 33-37, and 39-41 are rejected as being 
allegedly unpatentable over Wu (U.S. Patent No. 5,931,912) in view of Boyd (U.S. Patent No. 
6,1 1 2,238) in further view of Myerson (U.S. Patent No. 5,892,917) under 35 U.S.C. §103(a). 

UL Claims 4, 10, 19, 25, 32 and 38 are rejected as being allegedly unpatentable over Wu 
(U.S. Patent No. 5,931,912) in view of Boyd (U.S. Patent No. 6,112,238) and Myerson (U.S. 
Patent No. 5,892,917) in further view of Wilkerson (U.S. Patent No. 5,778,387) under 35 U.S.C. 
§1 03(a). 
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ARGTnVTKNT 

I. 35-U.S.C, S 103, Ohvionsne^s. rialm^ S. 11. 1^, ^Q^ anrf ai 

Claims 8, 1 1, 13, 23, 26, 28, 36, 39, and 41 are rejected under 35 U.S.C. 103(a) as bemg 
unpatentable over Wu in view of Boyd. This rejection is respectfully traversed. 

With regard to claims 8, 1 1, 1 3, 26, 28, 36, 39, and 41, the Examiner states: 

Wu discloses a method in a data processing system for analyzing a log, the 
method comprising analyzing a set of time segments in the log to deteraiine 
whether a tolerance of a time gap, with respect to an adjacent segment (column 7, 
lines 36-39) has been exceeded for a time segment within the set of time segments 
(column 9, lines 57-65) and responsive to a determination that the time gap 
tolerance has been exceeded for the time segm ent within the set of time segments, 
generating an alert in the form of a flag used by a program to process the log 
(column 9j line 65 to column 10, line 9), 

Wu discloses that the log includes a web log containing request data 
(column 5, lines 25-30) and that the method is implemented as a computer 
program product of corresponding instructions (column 5, lines 40-44), 

As noted above, the invention of Wu teaches many features of the claimed 
invention, and while Wu does disclose analyzing a set of time segments to 
detemoine whether a time gap tolerance has been exceeded for a time segment, 
Wu does not explicitly state that the set of time segments include at least one time 
segment defined by a user 

Boyd teaches a system and method for analyzing remote traffic data in a 
distributed computing environment including means for recording a data log of 
hits (column 2, lines 35-45) with the log segmented into a set of time segments for 
analysis (column 2, lines 45-51) wherein the set of time segments includes at least 
one time segment defined by a user (column 9, lines 1 5-23). 

It would have been obvious to one having ordinary skill in the art to 
modify the invention of Wu to include explicitly stating that the set of time 
segments include at least one time segment defined by a user, as taught by Boyd, 
because, as suggested by Boyd, the combination would have allowed the user to 
select a particular time interval of interest (column 9, lines 50-51) thereby 
increasing the efficiency of the analysis by only analyzing that which is of interest 
to the user as well as provided smaller time intervals of analysis to allow greater 
flexibility and speed in reporting the results (coluron 9, lines 23-27). 

(Final Office Action dated November 22, 2004, pages 2-3). 

For an invention to be prima facie obvious, the prior art must teach or suggest aU claim 
limitations. In re Royka, 490 F.2d 981, 1 80 USPQ 580 (CCPA 1974). The combination of Wu 
and Boyd fail to teach or suggest the present invention as recited in claims 8, 1 1 , 13, 23, 26, 28, 
36, 39, and 41. Independent claim 8, which is representative of independent claims 15, 23, and 
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36, reads as follows: 

8. A method in a data processing system for analyzing a log, the method 
comprising: 

analyzing a set of time segments in the log to determine whether a time 
gap tolerance has been exceeded for a time segment within the set of time 
segments, wherein the set of time segments include at least one time segment 
defined by a user; and 

responsive to a determination that the time tolerance has been 
exceeded for the time segment within the set of time segments, generating an 
alert 

Claim 8 recites the feature of analyzing a set of time segments in a log to determiDs whether a 

time gap tolerance has been exceeded for a time segment within the set of time segments. The 

Examiner cites tlie following sections of Wu as teaching this analyzing feature: 

The time gap represents the differ^ce between the time stamp of the current log 
and that of the access pair in the tail of the active session. 

(Wu, column 7, lines 36-39). 

FIG. 8 shows an example of a method for finding an active candidate session to 
append tlie current log entry and marking all the sessions which are considered 
dormant and should be closed (step 309). As depicted, in step 801, the first active 
session is selected from the head of the list of the active sessions. The process 
ends, in step 804, when all active sessions have been processed. In step 805, If 
the time gap is greater than a pre-specified time, TIME_FOR_CLOSE, for closing 
a session, then the dormant flag in the session header is set to a true value, in step 
806. 

(Wu, column 9, lines 57-66). 

The passages above teach a time gap, which represents the difiFerence between the 
timestamp of the current log and the timcstamp of the access pair in the tail of an active session. 
The passages also teach finding an active session to append the current log entry and marking 
sessions considered dormant. However, neither passage above teaches analyzing a set of time 
segments in a log to determine whether a time gap tolerance has been exceeded for a time 
segment, as taught by claim 8 of the present invention. 

EvaluatJ.ng the superficial similarities between Wu and the present invention highlights 
the evident differences between the two. Wu teaches time stamps, time gaps between time 
stamps, and whether or not time gaps are greater than pre-specified times, but Wu t^n^ nm t^^nU 
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timft5ifismmts . Oil the other hand, the present invention teaches time segments, time gap 
tolerances, and whether or not time gap tolerances have been exceeded for time segments. While 
Wu teaches a time gap and the present invention teaches a somewhat similar lime gap tolerance, 
how the time gaps are applied is quite different. fVu's time gap is a singular calculation, the 
difference between a current log's time stamp and an access pair's time stamp. In contrast, the 
present invention pTOvides a log's time segment, with a starting time and an ending time, which 
is analyzed numerous times for time gap tolerances. An example is illustrated in Figure 4B of the 
application, where a five hour time segment in a log is analyzed using a time gap tolerance of 
8,200 milliseconds, which would result in over 2,000 comparisons, quite dijfferent than Wu's 
singular comparison between the time stamps of a log and an access pair. 

The section of Wu that the Examiner cites as teaching a time segment only references the 
previously mentioned time gap again. Reviewing the definition of a time segment makes 
obvious the absence of a time segment in Wu. A time segment is a period of time, with both a 
starting time and an ending time, such as a period of hours in a day. Neither the ciurent log nor 
the access pair in >Fk has a starting time and an ending time, for such concepts do not apply to 
either feature in Wu. The log in Wu does not represent a period of time, nor does the access pair 
in Wu, Both the log and the access pair in Wu have a time stamp, but a time stamp ts not a time 
segment because a time stamp is a single data point that represents a single point in time. A time 
stamp is not a period of time with both a starting time and an ending time. Thus, Wu teaches 
analyzing a time gap between two time stamps, rather than analyzing a set of time segments in a 
log to determine whether a time gap tolerance has been exceeded for a time segment, as recited in 
claim 8 of the present invention. 

All limitations of the claimed invention must be considered when detmnining patentability. 
In reLowry, 32 F.3d 1579, 1582, 32 U.S.RQ.2d 1031, 1034 (Fed. Cir. 1994). In comparing Wu to 
the claimed invention to determine obviousness, limitations of the presently claimed invention may 
not be ignored. The present invention in claim 8 recites analyzing a set of time segments in a log 
to detemiine whether a time gap tolerance has been exceeded for a time segment. Such a feature 
is not taught or suggested by Wu. Therefore, claim 8 is not obvious in view of Wu, 

Furthermore, there is no teaching or suggestion in either Wu or Boyd as to the desirability 
of including the features firom the other reference. Although the Examiner relies upon Boyd to 
teach a time segment defined by a user, the purpose of Boyd's one-pass routine is to "summarize 
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the access information recorded for a user-requested time frame," which "enables the server 10 to 
efficiently analyze traffic data by utilizing existing summaries 19A-C whenever possible." 
(Column 9, lines 17-47). Boyd does not even mention time g^s or time gap tolerance, much less 
the need for detecting a time gap, as specified in the present invention. This is because Boyd is 
concerned with summarizing data previously existing for time slices, not with the present 
invention's detection of time gaps in logs in order to determine which logs to process differently. 
Because the concept of a time gap is inapplicable in Boyd, there is no teaching or suggestion to 
modify Boyd to include the teachings of inventions addressing the issue of time gaps, such as in 
Wu, 

Additionally, Wu 's use of time gaps also differs significantly fi^m Boyd's use of time 
slices. This is because Wu uses time gaps in "[a] method and system to map client access 
pattems/'* (Abstract) Wu's use of time gaps contrasts with Boyd^s summarizing data previously 
existing for time sUces. Because, as discussed above, the concept of a time segment in 
inapplicable in Wu^ there is no teaching or suggestion to modify Wu to include the teachings of 
inventions summarizing data previously existing for time segments, such as in Boyd. 
Understandably, there is no teaching or suggestion in either Wu or Boyd as to the desirability of 
including the features fixjm the other reference. 

Therefore, even if Wu taught analyzing a set of time segments in a log to determine 
whether a time gap tolerance has been exceeded for a time segment, as alleged by the Examiner, 
the combination of Wu with Boyd would still not be the invention as recited in claim 8 of the 
present invention. Rather, such an alleged combination would result in a system using time gaps 
for mapping client access patterns, substantially as taught in Wu, with the additional feature of 
summarizing data previously existing for time slices, substantially as taught in Boyd, A system 
that uses time gaps in relation to access pairs in the tail of an active session is both real-time and 
dynamic. Such a system would not benefit fcom the addition of a feature oriented towards 
summarizing historical and static data. Even considering Boyd, the cited references fail to teach 
or suggest analyzing a set of time segments in a log to detenninc whether a time gap tolerance 
has been exceeded for a time segment, as recited in claim 8. 

Moreover, even if Wu taught analyzing a set of time segments in a log to determine 
whether a time gap tolerance has been exceeded for a time segment, as alleged by the Examiner, 
one of ordinary skill in the art would not combine Wu with Boyd when each reference is 
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considered as a whole. In considering the references as a whole, one of ordmaiy skill in the art 

would take into account the problems recognized and solved. For example, Boyd teaches: 

... a system, method, and storage medimn embodying confiputer-readable code for 
analyzing traffic data in a di stributed computing environment. The distributed 
computing environment includes a plurality of interconnected systems operatively 
coupled to a server, a source of trafSe data hits and one or more results tables 
categorized by associated data types, 

(Column 2, lines 28-34), 

Boyd is directed towards analyzing trafBc data in a distributed computing environment 
through the use of results tables categorized by associated data types. Concerning these results 
tables^ Boyd teaches "[e]ach entry in a microtable 45 A contains an index 46 pointing to a record 
within its associated results table 40B which requires adjustment for inflation." (Column?, lines 
33-35). Boyd explains the need for inflation adjustment through an example: "A count of the 
number of open sessions spanning each time slice is made in the user session table 43 . . . 
[d]uring analysis, the access infonnation is adjusted to remove the inflation." (Column 7, lines 
46-54). Boyd is explicit in how this inflation adjustment is conducted: "The summary of the time 
frame of the first and second time slice will be inflated unless the double-counts are subtracted 
from the number of open sessions for this web page for the second time slice." (Column 1 U lines 
3-6). Boyd teaches subtracting counts from summarized results due to "double, triple, or 
multiple counting of open sessions spanning multiple time slices." (Column 7, lines 61-62). 
Therefore, Boyd is directed towards meeting the "need for a system and method to efficiently 
process the voluminous amounts of access information generated by web servers in a timely, 
expedient manner without the attendant costs associated wjth large scale hardware 
requirements," by providing a system that "enables the server 10 to efficiently analyze traiSc data 
by utilizing existing summaries 19A-C whenever possible" and subtracts multiple counting to 
adjust for data inflation. (Column 2, lines 7-11, column 9, lines 45-47, respectively). In 
summary, Boyd eflSciently analyzes server traffic through summarizing existing summaries and 
subtracting inflated counts* 

In contrast, Wu is directed towards mapping client access patterns in a stateless hypertext 
server. For each hypertext object access, information about the access is collected, including the 
hyperlink source (i.e., the hyper-text object that refers the client to the target object) and the 
hyperlink target (i.e., the hypertext object being accessed). A hyperlink access pair is formed 
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from the hyperlink source and target, which represents a step in the user traversal path on the 
hypertext ohjects. Hyperlink access pairs are mapped into hyperlink access groups. These 
hyperlink groups can be used to provide user-oriented object usage statistics. (Wu^ Abstract). 
Thus, Wii teaches mapping client access patterns in order to provide user-oriented object usage 
statistics and Boyd teaches efficiently analyzing server traffic through summarizing existing 
summaries and subtracting inflated counts. Wu is directed tov^ards user-oriented object usage 
statistics while Bpyd is directed towfards ef6ciently analyzing server traffic. Therefore, one of 
ordinary skill in the art would not attempt to combine Wu with Boyd, 

As the Examiner has failed to demonstrate any motivation or incentive in the prior art to 
combine and modify the references so as to achieve the claimed invention, the alleged 
combination can only be the result of impermissible hindsight reconstruction using Applicant's 
own disclosure as a guide. While* Applicant understands that all examination entails some 
measure of hindsight, when the rejection is based completely on hindsight, as in the present case, 
to the exclusion of what can be gleaned from the references, then the rejecti on is improper and 
should be withdrawn. 

In view of the above. Applicant submits tliat independent claims 8, 23, and 36 are not 
taught or suggested by the alleged combination of Boyd and Wu. Claims 11, 13, 26, 28, 39, and 
41 are dependent claims depending from independent claims 8, 23, and 36, respectively. These 
dependent claims are also allowable, at least by virtue of their dependency on an allowable claim. 

Therefore, the rejection of claims 8, 11, 13, 26, 28, 36, 39, and 41 under 35 U.S.C. § 103 
has been overcome. 

n. 3S ir . S . r , S 1Q3 , QhYinnsnft^s^ . Clnims 1 - 1 . S - Q , 2 0-^4^ ivi7 anrf ^o^i 

Claims 1, 3, 5-9, 1 1-18, 20^24, 26^31, 33-37, and 39-41 are rejected under 35 U.S.C. 

103(a) as being unpatentable over Wu in view of Boyd in further view of Myerson. This rejection 

is respectfully traversed. 

With regard to claims 1, 3, 5-9, 1 1-18, 20-24, 26-31. 33-37, and 39-41, the Examiner 

states: 

Myerson di scloses a method in a data processing system for maintaining 
data integrity in logs, the method comprising reviewing a log, such as a web-log 
including request data (column 1, lines 49-52 and column 5, lines 23-54), 
determining whether the log contains a data loss (column 3, lines 13-17)/and 
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adding data froTn a prior log to replace the data loss m the log (column 3> lines 1 7- 
20) to increase the integrity of the log if a determination is made that a data loss 
has occurred (column 2, lines 27-42), wherein the data is added to a particular 
time segment of the log (column 3, lines 13-20). 

Myerson discloses that the log includes a sequence/set of time segments 
(colunm 2» lines 60-62) calculating a data integrity level for the log and comparing 
the integrity level to a threshold in order to determine if an acceptable level of 
integrity has been reached (column 8, lines 47-58). 

Myerson also discloses that the method is implemented as a computer 
program product of coixesponding instructions (column 4, line 40) in a system 
comprising a memory containing the instructions (coJumu 4, lines 18-19), a 
processing unit for executing the instructions (column 4, lines 16-17), a 
communications unit (column 4, Une 19) and a user interface (column 4, line 19), 
all connected to a bus (Figure 1). 

As noted above, the invention of Myerson teaches many features of the 
claimed invention, and while Myerson does teach analyzing frequency (i.e. time) 
difference in the current web-log to determine if data should be appended (column 
8, line 66 to column 9, line 7), Myerson does not specijfically disclose flagging the 
determination of an excessive time gap for log analysts. . . 

As noted above, the invention of Myerson and Wu teaches many features 
of the claimed in vention, and while invention of Myerson and Wu does disclose 
analyzing a set of time segments to determine whettier a time gap tolerance has 
been exceeded for a time segment, the combination does not explicitly state that 
the set of time segments include at least one time segment defined by a user. 

Boyd teaches a system and method for analytring remote traffic data in a 
distributed computing environment including means for recorxJing a data log of 
hits (column 2, lines 35-45) with the log segmented into a set of time segments for 
analysis (column 2, lines 45-51) wherein the set of time segments includes at least 
one time segment defined by a user (column 9, lines 1 5-23). 

It would have been obvious to one having ordinary skill in the art to 
modify the invention of Wu to include explicitly stating that the set of time 
segments include at least one time segment defmed by a user, as taught by Boyd, 
because, as suggested by Boyd, the combination would have allowed the user to 
select a particular time interval of interest (column 9, lines 50-51) thereby 
increasing the efficieTicy of the analysis by only analyzing that which is of interest 
to the user as well as provided smaller time intervals of analysis to allow greater 
flexibility and speed in reporting the results (column % lines 23-27). 

(Final Office Action dated November 22, 2004, pages 4-6). 

Independent claim 1, which is representative of independent claims 8, 14, 15, 16, 23, 29, 
and 36, reads as follows: 

1 . A method in a data processing system for maintaining data integrity in 
logs^ the method comprising: 
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reviewmg a log, wherein the log includes a set of time segments, and 
wherein the set of time segments include at least one time segment defined by a 
user, 

determining whether the log contains a data loss, wherein the determining 
step includes analyzing each time segment within the set of time segroents to 
determine whether a time segment gap tolerance has been exceeded; and 

adding data to replace the data loss in the log to increase integrity of the 
log if a detennination is made that a data loss has occurred. 

While Myerson teaches a log file (column 2, lines 60-62), Myerson teaches analysiag a 
web site log file and generating an expanded log file that compensates for information caching 
and gateway based web site access. The log file used to create the expanded log file contains 
information representing the Internet address and Authenticated User name of the requester, an 
Went name, a timcstamp, the request, a response code, and a response size. (Column 5, lines 23- 
55). Myerson does not teach analyzing a set of time segments in a log to determine whether a 
time gap tolerance has been exceeded for a time segment. Myerson merely teaches having 
timestamp information within the files. This timestamp information specifies the starting time of 
the communication between the client computer and the web site. (Column 5, lines 43-45). This 
timestamp information is not a time segment. Thus, while claim 1 of the present invention 
teaches analyzing a set of time segments in a log to determine whether a time gap tolerance has 
been exceeded for a time segment^ Myerson merely teaches automated timestamp data indicating 
the start of a cHent session. Therefore, Myerson fails to teach analyzing a set of time segments in 
a log to determine whether a time gap tolerance has been exceeded for a time segment, as recited 
in claim 8 of the present invention. 

Additionally, claim 1 of the present invention recites the feature of detennining whether 
the log contains a data loss, wherein the determining step includes analyzing each time segment 
within the set of time segments to determine whether a time segment gap tolerance has been 
exceeded. The Examiner alleges that Myerson teaches a determination whether a log contains a 
data loss in the passage below: 

The log expansion procedure fiirthermore assigns session identifiers to each log 
record so as to group the sequence of log record$ into pseudo-client sessions. It 
then detects when log records are missing ftom the pseudo-client sessions and 
supplements the sequence of log records with log records representing additional 
object requests so as to create pseudo-cUent sessions each having a logical 
sequence of object requests. 
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{Myerson, column 3, lines 1 3-20). The Examiner further states Id the Final Office Action that 

"Myerson does teach analyzing frequency (i.e. tinne) difference in the current web-log to 

determine if data should be appended," in the passage below: 

In other words, In one preferred embodimentj if the frequency of requests for the 
most popular objects is at least 15% lower than the frequency of requests found in 
the reference request profile, then the threshold amount of object cacliing for 
performing additional log entry insertion has been detected. As will be 
understood by those of ordinary skill in the art, numerous slightly different 
procedures can be used to compare the current and reference request profiles for 
the purpose of detecting high rates of object caching. 

(Myerson, column 8, line 66, to column 9, line 7). As can be seen, neither passage mentions 
anything about analyzing time segments present in a log to determine whether a time segment 
gap tolerance has been exceeded. ThuSj Myerson fails to teach the feature of analyzing each time 
segment within a set of time segments to determine whether a time segment gap tolerance has 
been exceeded, as recited in claim 1 of the present invention. 

As stated in the argument presented in section I, Boyd and Wu are not combinable, and 
Wu does not teach all the features that the Examiner alleges. Furtheonore, one of ordinary skill 
in the art would not combine Boyd with Myerson and Wu when each reference is considered as a 
whole. In considering the references as a whole, one of ordinary skill in die art would take into 
account the problems recognized and solved. For example, Myerson teaches a system and 
method for analyzing a Web site log file and generating an expanded log file that compensates 
for information caching and gateway based Web site access. The log expansion procedure 
analyzes a sequence of log records so as to detect object request patterns indicating that object 
requests not represented by the log records were satisfied by cached object copies, and then 
supplements the sequence of log records with inserted log records representing object r^uests 
for the objects corresponding to the cached object copies. As a result, the supplemented sequence 
of log records more accurately represents object requests made by cHent computers than the 
initial sequence of log records in the log file. {Myerson, Abstract). Myerson is directed towards 
adding data to log files when caching occurs. Myerson teaches supplementing a log file to more 
axjcuratcly represent object requests made by a client than the initial sequence of log records in 
the log file (Abstract). Myerson is directed toward adding reasonable data to log files when 
certain Web content fi-om the content server is cached elsewhere and is therefore not represented 
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as being accessed in the Web content server log j51e(s). 

In contrast, Wu teaches mapping client access patterns in order to provide user-oricntcd 
object usage statistics and Boyd teaches ejfficiently aaalyzing server traffic through summarizing 
existing summaries and subtracting inflated coimts. Thus, Myerson is directed towards 
supplementing log files with cached data, Wu is directed towards user-oriented object usage 
statistics, Boyd i$ directed towards efficiently analyzing server traffic while subtracting inflated 
counts, and none of the cited references is directed towards supplementing existing log files, as is 
the present invention. 

Furthennore, even Myerson taught what the Examiner alleges, there is no teaching or 
suggestion in the references as to the desirability of including the features from the other 
references. As the Examiner has failed to demoiistrate any motivation or incentive in the prior 
art to combine and modify the references so as to achieve the claimed invention, the alleged 
combination can only be the result of impermissible hindsight reconstruction using Applicant's 
own disclosure as a guide. While Applicant understands that all examination entails some 
measure of hindsight, when the rejection is based completely on hindsight, a5 in the present case, 
to the exclusion of what can be gleaned from the references, then the rejection is improper and 
should be withdrawn. 

Even if Wu was properly combinable with Boyd and Myerson, the result of such a 
combination would not be tlie invention as recited in claim 1 of the present invention. Rather, 
such an alleged combination would result in a system substantially as taught in Wu in addition to 
the features of summarizing data previously existing for time slices and adding data to log files 
when caching occurs. Even considering Myerson, the cited references fail to teach or suggest 
analyzing a set of time segments in a log to determine whether a time gap tolerance has been 
exceeded for a time segment, as recited in claim 1 . 

In view of the above. Applicant submits that independent claims 1, 8, 14, 15, 16, 23, 29 
and 36 are not taught or suggested by the alleged combination oiBoyd, Myerson and Wu, Claims 
3, 5-7, 9, 1U13, 18, 20-22, 24, 26-28, 31, 33^35, 37, and 39^1 arc dependent claims depending 
firom independent claims I, 8, 16, 23, 29, and 36, respectively These dependent claims are also 
allowable, at least by virtue of their dependency on an allowable claim. Therefore, the 
rejection of claims 1 , 3, 5-9, 1 1-18, 20-24, 26-31, 33-37, and 39-41 under 35 U.S.C. § 103 has 
been overcome, 
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IIL 3ff TJ,S,r, § 103, Ohvioiisnp.^^, aaims 4, It), 19, 2S, 32, and 38 

I. 

Claims 4, 10, 1 9, 25, 32 and 38 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Wit in view of Boyd and Myerson in further view of Wilkerson. This rejection i$ 
respectfully traversed. 

As stated in the argument presented in section I, Wu does not teach all the features that 
the Examiner alleges, and, as stated in the arguments presented in section n, not only does 
Myerson fail to teach all the features that the Examiner alleges, but Boyd, Wu and Myerson are 
not combinable. Furthermore, one of ordinary slcill in the art would not combine Boyd with 
Myerson, Wu and Wilkerson when each reference is considered as a whole. In considering the 
references as a whole, one of ordinary skill in the art would take into account the problems 
recognized and solved. For example, Wilkerson teaches a method and an apparatus that 
automates the database recovery process. A person not technically skilled in the use of a 
computer can operate the new procedure. In accordance with the invention, the user identifies 
the cormpted database and enters the database name and estimated timestamp for the computer. 
The database recovery system automatically creates program control language and executes the 
language wherein the result provides a new, more accurate time stamp. The recoveiry system 
then creates additional program control language using the new time stamp and executes the 
program control language which then recovers the uncorrupted data. The user does not need to 
look up, write, or enter any program control language because these fimctions are fully 
automated. {Wilkerson, Abstract). Wilkerson is directed towards an automated database 
recovery process for people who arc not technically skilled in the use of a computer. Wilkerson 
teaches the use of estimated timestamps for the purpose of calculating a new, more accurate time 
stamp, which is then used to recover uncorrupted data. (Abstract). Wilkerson is not directed 
towards analyzing a set of time segments in a log to determine whether a time gap tolerance ha$ 
been exceeded for a time segment. Instead, Wilkerson is directed toward a fully automated 
recovefy system where users do not need to look up, write, or enter any program control 
language. 

In contrast, Wu teaches mapping client access patterns in order to provide user-oriented 
object usage statistics, Boyd teaches efficiently analyzing server traffic through summarizing 
existing summaries whUe subtracting inflated counts and Myerson teaches supplementing a log 
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file to more accurately represent object requests made by a client. Thus, Wilkerson is directed 
towards an autoinated database recovery process for people not skilled in computer use, Myerson 
is directed towards supplementing log files with cached data, Wu is directed towards user- 
oriented object usage statistics, Boyd is directed towards efficiently analyzing server traffic and 
subtracting inflated counts, and none of the cited references is directed towards analyzing a set of 
time segments in a log to determine whether a time gap tolerance has been exceeded for a time 
segment, as is tlie present invention. 

Additionally, there is no teaching or suggestion in the references as to the desirabiUty of 
including the features firom the other references. As the Examiner has failed to demonstrate any 
motivation or incentive in the prior art to combine and modify the references so as to achieve the 
claimed invention, the alleged combination can only be the result of impermissible hindsight 
reconstruction using Applicant's own disclosure as a guide. While Applicant understands that all 
examination entails some measure of hindsight, when the rejection is based completely on 
hindsight, as in the present case, to the exclusion of what can be gleaned from the references, 
then the rejection is improper and should be withdrawn. 

Even if Wu was properly combinable with Boyd, Myerson, and Wilkerson, the result of 
such a combination would not be the invention as recited in claims 4, 10, 19, 25, 32 and 38 of the 
present invention. Rather, such an alleged combination would result in a system substantially as 
taught in Wu in addition to the features of summarizing data previously existing for time slices, 
adding data to log files when caching occurs, and an automated database recovery process for 
people who are not technically skilled in the use of a computer. Even considering Wilkerson, the 
cited references fail to teach or suggest analyzing a set of time segments in a log to determine 
whether a time gap tolerance has been exceeded for a time segment, as recited in the claims upon 
which claims 4, 10, 19, 25, 32 and 38 depend. 

Furthermore, if an independent claim is nonobvious under 35 U.S.C §103, then any 
claim depending therefrom is nonobvious. In re Fine, 837 .F.2d 1071, 5 USPQ2d 1596 (Fed. 
Cir. 1988). Claims 4, 10, 1 9, 25, 32, and 38 are dependent claims depending upon independent 
claims 1, 8, 16, 23, 29, and 36, respectively Applicant has ah-eady demonstrated claims 1, 8, 
16, 23, 29, and 36 to be in condition for allowance. Applicant respectfully submits that claims 
4, 10, 1 9, 25, 32, and 38 arc also allowable, at least by virtue of their dependency on an 
allowable claim. 
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